Suyu/breakpad
1
0
Fork 0
mirror of https://git.suyu.dev/suyu/breakpad.git synced 2025-12-29 10:45:28 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

exploitability: fix buffer overflow

Browse source 
exploitability_linux assumed a 15 byte buffer to always be passed in as
`raw_bytes` for `DisassembleBytes`. This test was passing in a 6 byte
buffer. Make `DisassembleBytes` accept a length.

Bug: b:235999011
Change-Id: I696c66357faa1c7d762c64009864123897f03488
Reviewed-on: https://chromium-review.googlesource.com/c/breakpad/breakpad/+/3756170
Reviewed-by: Mike Frysinger <vapier@chromium.org>
This commit is contained in:
George Burgess IV 2022-07-11 12:37:19 -07:00 • committed by George Burgess
parent c161459d7e
commit 4d7cd09800
3 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/processor/exploitability_linux.cc
View file

@ -232,6 +232,7 @@ bool ExploitabilityLinux::EndedOnIllegalWrite(uint64_t instruction_ptr) {
char objdump_output_buffer[MAX_OBJDUMP_BUFFER_LEN] = {0};
DisassembleBytes(architecture,
raw_memory + offset,
MAX_INSTRUCTION_LEN,
MAX_OBJDUMP_BUFFER_LEN,
objdump_output_buffer);
@ -483,9 +484,11 @@ bool ExploitabilityLinux::TokenizeObjdumpInstruction(const string& line,
bool ExploitabilityLinux::DisassembleBytes(const string& architecture,
const uint8_t* raw_bytes,
const unsigned int raw_bytes_len,
const unsigned int buffer_len,
char* objdump_output_buffer) {
if (!raw_bytes || !objdump_output_buffer) {
if (!raw_bytes || !objdump_output_buffer ||
raw_bytes_len > MAX_INSTRUCTION_LEN) {
BPLOG(ERROR) << "Bad input parameters.";
return false;
}
@ -499,8 +502,7 @@ bool ExploitabilityLinux::DisassembleBytes(const string& architecture,
unlink(raw_bytes_tmpfile);
return false;
}
if (write(raw_bytes_fd, raw_bytes, MAX_INSTRUCTION_LEN)
!= MAX_INSTRUCTION_LEN) {
if (write(raw_bytes_fd, raw_bytes, raw_bytes_len) != raw_bytes_len) {
BPLOG(ERROR) << "Writing of raw bytes failed.";
unlink(raw_bytes_tmpfile);
return false;